Configuring Website Security Settings

1. Website Security Fundamentals

Website security is not a single setting but a layered defence strategy. No single measure is 100% foolproof — the goal is to make your site a harder target than the next. Think in terms of these layers:

• Transport security — encrypt data in transit (HTTPS/TLS)
• Application security — sanitise inputs, use security headers, keep software updated
• Access control — limit who can log in, what they can do, and from where
• Monitoring — detect and respond to unusual activity quickly

2. Enabling HTTPS and SSL/TLS

HTTPS encrypts all traffic between your visitor's browser and your server. Without it, passwords, form data, and session tokens travel in plain text — readable by anyone on the same network.

Steps to enable HTTPS:

1. Obtain an SSL/TLS certificate — free via Let's Encrypt (auto-renews every 90 days), or from your hosting provider
2. Install the certificate on your server or enable it through your hosting control panel (cPanel, Plesk, etc.)
3. Redirect all HTTP traffic to HTTPS with a 301 redirect
4. Update all internal links and asset URLs from http:// to https://
5. Enable HSTS (HTTP Strict Transport Security) to prevent downgrade attacks

3. Security Headers

HTTP security headers instruct browsers on how to behave when rendering your pages. They are one of the most cost-effective security improvements you can make.

For Netlify, add these headers in a netlify.toml file under the [[headers]] section, or in a _headers file in your publish directory.

4. Login Page Protection

Brute-force attacks systematically try thousands of password combinations against your login page. Defend against them with:

• Rate limiting — block IPs after repeated failed attempts
• CAPTCHA — add reCAPTCHA v3 or Cloudflare Turnstile after multiple failures
• Account lockout — lock after 10 failures, notify the user, require email unlock
• Two-factor authentication — see the 2FA guide
• Change the default login URL — on WordPress, change /wp-admin to a custom path

5. File and Directory Permissions

Incorrect file permissions let attackers read sensitive configuration files or execute malicious scripts. Follow the principle of least privilege:

• Directories: 755 (owner can write; group and others can read and execute)
• Files: 644 (owner can read/write; others read only)
• Config files (wp-config.php, .env): 600 or 640
• Never set files or directories to 777 (world-writable)

Additionally, block access to sensitive files via your web server configuration or .htaccess: deny public access to .env, composer.json, and backup archives.

6. Regular Security Audits

Security is not a one-time task. Schedule regular reviews to catch issues before attackers do:

7. Troubleshooting

For further assistance, contact our support team.